使用 Terraform 模塊導入現有 AWS 資源

Question

我正在嘗試使用 terraform 模塊導入現有的 S3 存儲桶。我能夠成功導入它，但我現在面臨的問題是，成功導入后，當我運行 terraform 計划命令時，它仍然顯示它將再次創建資源。 如果有人能幫助我解決我在這里做錯的事情，那就太好了。

我的模塊：

module "log_s3" {
  source               = "../modules/s3/"
  env_name             = var.env_name
  bucket_name          = "${var.product_name}-logs-${var.env_name}"
  enable_versioning    = false
  enable_cors          = false
  logging_bucket       = module.log_s3.log_bucket_id
  enable_bucket_policy = true
  enable_static_site   = false
}

我的資源：

resource "aws_s3_bucket" "my_protected_bucket" {
  bucket = var.bucket_name
  tags = {
    environment              = var.env_name
  }
}

resource "aws_s3_bucket_acl" "my_protected_bucket_acl" {
  bucket = aws_s3_bucket.my_protected_bucket.id
  acl    = var.enable_static_site == true ? "public-read" : "private"
}

resource "aws_s3_bucket_public_access_block" "my_protected_bucket_access" {
  bucket = aws_s3_bucket.my_protected_bucket.id

  # Block public access
  block_public_acls       = var.enable_static_site == true ? false : true
  block_public_policy     = var.enable_static_site == true ? false : true
  ignore_public_acls      = var.enable_static_site == true ? false : true
  restrict_public_buckets = var.enable_static_site == true ? false : true
}

resource "aws_s3_bucket_versioning" "my_protected_bucket_versioning" {
  count  = var.enable_versioning ? 1 : 0
  bucket = aws_s3_bucket.my_protected_bucket.id
  versioning_configuration {
    status = "Enabled"
  }
}

resource "aws_s3_bucket_cors_configuration" "my_protected_bucket_cors" {
  count  = var.enable_cors ? 1 : 0
  bucket = aws_s3_bucket.my_protected_bucket.id

  cors_rule {
    allowed_headers = ["*"]
    allowed_methods = ["PUT", "POST", "DELETE", "GET", "HEAD"]
    allowed_origins = ["*"]
    expose_headers  = [""]
  }
  lifecycle {
    ignore_changes = [
      cors_rule
    ]
  }

}

resource "aws_s3_bucket_ownership_controls" "my_protected_bucket_ownership" {
  bucket = aws_s3_bucket.my_protected_bucket.id

  rule {
    object_ownership = "ObjectWriter"
  }
}

resource "aws_s3_bucket_server_side_encryption_configuration" "my_protected_bucket_sse_config" {
  bucket = aws_s3_bucket.my_protected_bucket.id

  rule {
    apply_server_side_encryption_by_default {
      sse_algorithm = "AES256"
    }
  }
}


resource "aws_s3_bucket_policy" "my_protected_bucket_policy" {
  count  = var.enable_bucket_policy ? 1 : 0
  bucket = aws_s3_bucket.my_protected_bucket.id
  policy = <<EOF
{
    "Version": "2012-10-17",
    "Id": "S3-Console-Auto-Gen-Policy-1659086042176",
    "Statement": [
        {
            "Sid": "S3PolicyStmt-DO-NOT-MODIFY-1659086041783",
            "Effect": "Allow",
            "Principal": {
                "Service": "logging.s3.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "${aws_s3_bucket.my_protected_bucket.arn}/*"
        }
    ]
}
EOF
}

resource "aws_s3_object" "my_protected_bucket_object" {
  bucket = var.logging_bucket
  key    = "s3_log/${aws_s3_bucket.my_protected_bucket.id}/"
}

resource "aws_s3_bucket_logging" "my_protected_bucket_logging" {
  bucket = aws_s3_bucket.my_protected_bucket.id
  target_bucket = var.logging_bucket
  target_prefix = "s3_log/${aws_s3_bucket.my_protected_bucket.id}/"
  depends_on    = [aws_s3_bucket.my_protected_bucket, aws_s3_object.my_protected_bucket_object]
}

resource "aws_s3_bucket_website_configuration" "my_protected_bucket_static" {
  bucket = aws_s3_bucket.my_protected_bucket.id
  count  = var.enable_static_site ? 1 : 0

  index_document {
    suffix = "index.html"
  }

  error_document {
    key = "error.html"
  }
}

output.tf

output "log_bucket_id" {
  value = aws_s3_bucket.my_protected_bucket.id

Terraform 導入命令：我運行了以下命令來導入存儲桶

terraform import module.log_s3.aws_s3_bucket.my_protected_bucket abcd-logs-dev

output：

module.log_s3.aws_s3_bucket.my_protected_bucket: Import prepared!
  Prepared aws_s3_bucket for import
module.log_s3.aws_s3_bucket.my_protected_bucket: Refreshing state... [id=abcd-logs-deveu]

Import successful!

The resources that were imported are shown above. These resources are now in
your Terraform state and will henceforth be managed by Terraform.

Terraform計划：

成功導入后..當我運行terraform 計划命令時，它顯示 terraform 將創建新資源

module.log_s3.aws_s3_bucket.my_protected_bucket: Refreshing state... [id=abcd-logs-dev]

Terraform used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # module.log_s3.aws_s3_bucket_acl.my_protected_bucket_acl will be created
  + resource "aws_s3_bucket_acl" "my_protected_bucket_acl" {
      + acl    = "private"
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)

      + access_control_policy {
          + grant {
              + permission = (known after apply)

              + grantee {
                  + display_name  = (known after apply)
                  + email_address = (known after apply)
                  + id            = (known after apply)
                  + type          = (known after apply)
                  + uri           = (known after apply)
                }
            }

          + owner {
              + display_name = (known after apply)
              + id           = (known after apply)
            }
        }
    }

  # module.log_s3.aws_s3_bucket_logging.my_protected_bucket_logging will be created
  + resource "aws_s3_bucket_logging" "my_protected_bucket_logging" {
      + bucket        = "abcd-logs-dev"
      + id            = (known after apply)
      + target_bucket = "abcd-logs-dev"
      + target_prefix = "s3_log/abcd-logs-dev/"
    }

  # module.log_s3.aws_s3_bucket_ownership_controls.my_protected_bucket_ownership will be created
  + resource "aws_s3_bucket_ownership_controls" "my_protected_bucket_ownership" {
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)

      + rule {
          + object_ownership = "ObjectWriter"
        }
    }

  # module.log_s3.aws_s3_bucket_policy.my_protected_bucket_policy[0] will be created
  + resource "aws_s3_bucket_policy" "my_protected_bucket_policy" {
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)
      + policy = jsonencode(
            {
              + Id        = "S3-Console-Auto-Gen-Policy-145342356879"
              + Statement = [
                  + {
                      + Action    = "s3:PutObject"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "logging.s3.amazonaws.com"
                        }
                      + Resource  = "arn:aws:s3:::abcd-logs-dev/*"
                      + Sid       = "S3PolicyStmt-DO-NOT-MODIFY-145342356879"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
    }

  # module.log_s3.aws_s3_bucket_public_access_block.my_protected_bucket_access will be created
  + resource "aws_s3_bucket_public_access_block" "my_protected_bucket_access" {
      + block_public_acls       = true
      + block_public_policy     = true
      + bucket                  = "abcd-logs-dev"
      + id                      = (known after apply)
      + ignore_public_acls      = true
      + restrict_public_buckets = true
    }

  # module.log_s3.aws_s3_bucket_server_side_encryption_configuration.my_protected_bucket_sse_config will be created
  + resource "aws_s3_bucket_server_side_encryption_configuration" "my_protected_bucket_sse_config" {
      + bucket = "abcd-logs-dev"
      + id     = (known after apply)

      + rule {
          + apply_server_side_encryption_by_default {
              + sse_algorithm = "AES256"
            }
        }
    }

  # module.log_s3.aws_s3_object.my_protected_bucket_object will be created
  + resource "aws_s3_object" "my_protected_bucket_object" {
      + acl                    = "private"
      + bucket                 = "abcd-logs-dev"
      + bucket_key_enabled     = (known after apply)
      + content_type           = (known after apply)
      + etag                   = (known after apply)
      + force_destroy          = false
      + id                     = (known after apply)
      + key                    = "s3_log/abcd-logs-dev/"
      + kms_key_id             = (known after apply)
      + server_side_encryption = (known after apply)
      + storage_class          = (known after apply)
      + tags_all               = (known after apply)
      + version_id             = (known after apply)
    }

Plan: 7 to add, 0 to change, 0 to destroy.

如果有人可以幫助解決我做錯的事情，那就太好了。 非常感謝您的幫助。

謝謝

Answer 1

您導入的資源類型為log_s3.aws_s3_bucket並命名為my_protected_bucket 。 Terraform 計划 output 中沒有列出類型為log_s3.aws_s3_bucket的資源。它正確導入了 S3 存儲桶資源，並且沒有嘗試創建新的 S3 存儲桶。

Terraform 計划表示要創建的資源類型是：

• log_s3.aws_s3_bucket_acl
• log_s3.aws_s3_bucket_logging
• log_s3.aws_s3_bucket_ownership_controls
• log_s3.aws_s3_bucket_policy
• log_s3.aws_s3_bucket_public_access_block
• log_s3.aws_s3_object

您還沒有導入任何這些資源。 您仍然需要導入這些資源中的每一個。

Answer 2

是的，這里的簡單問題是您只將 S3 存儲桶資源導入您的 state。

使用模塊時，僅在該模塊中導入單個資源是不夠的。 您必須為該模塊中存在的所有資源運行導入命令。

您當前正在運行以下導入命令。

terraform import module.log_s3.aws_s3_bucket.my_protected_bucket abcd-logs-dev

這僅將 S3 存儲桶導入您的 state。但是如果您查看您的模塊，您還有其他資源。 因此，您必須對模塊中存在的其他資源運行類似的導入命令，如下所示。

terraform import module.log_s3.aws_s3_bucket_acl.my_protected_bucket_acl abcd-logs-dev

請檢查下面的 s3 bucket acl import https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl#import

同樣，對模塊中的所有資源運行 import 命令，然后運行terraform plan 。 它會起作用。